Some match bypass?

how to save request and response payload in an alert of eve.json.
i experimented but only get one-direction log.
such as
image
i only get “530 User cannot log in.\r\n221 Goodbye.”